Release v0.1.8: Compliance foundation, GDPR deletion, and landing page rewrite

12 February 2026

What changed

• Landing page rewrite — Replaced broken placeholder text with professional copy including sector-specific targeting, trust metrics, a "How It Works" flow, 6 feature cards, PAYG pricing section, and security/compliance callouts.
• GDPR Article 17 — Right to Erasure — Rebuilt the /api/people/gdpr-delete endpoint with two modes: soft-delete (anonymises PII, retains record structure for compliance) and full-delete (permanent destruction). Documented retention policies per Money Laundering Regulations 2017, HMRC requirements, and SOC 2.
• GDPR Article 20 — Right to Data Portability — New GET /api/people/gdpr-export endpoint. Exports all user data (people, matches, reviews, credits, transactions, notification prefs, API key metadata, audit log) as a downloadable JSON file.
• Settings page — Added export and delete controls, two-tier deletion UI, retention policy reference table, and legal basis documentation.
• CSS fix — Added destructive-foreground variable for delete button styling in light and dark modes.

Why it matters

This release lays the compliance foundation. Users now have proper GDPR data rights (export and deletion) backed by legally documented retention policies, and the landing page finally communicates what the product does.

Technical notes

• GDPR delete soft-mode anonymises across 7 tables: people, matches, matchReviews, apiKeys, notificationPreferences, creditAccounts/creditTransactions, and auditLog.
• Audit log entries are never deleted (SOC 2) — userId is replaced with GDPR_DELETED.
• Screening records retained 6 years; financial records 7 years; audit log indefinite (anonymised).
• +964 / -83 lines across 5 files.